Re: [PATCH iwl-net] idpf: fix xdp crash in soft reset error path

[Alexander Lobakin <aleksander.lobakin@intel.com>]

From: Emil Tantilov <emil.s.tantilov@intel.com>
Date: Tue, 17 Mar 2026 18:15:45 -0700

> NULL pointer dereference is reported in cases where idpf_vport_open()
> fails during soft reset:
> 
> ./xdpsock -i <inf> -q -r -N
> 
> [ 3179.186687] idpf 0000:83:00.0: Failed to initialize queue ids for vport 0: -12
> [ 3179.276739] BUG: kernel NULL pointer dereference, address: 0000000000000010
> [ 3179.277636] #PF: supervisor read access in kernel mode
> [ 3179.278470] #PF: error_code(0x0000) - not-present page
> [ 3179.279285] PGD 0
> [ 3179.280083] Oops: Oops: 0000 [#1] SMP NOPTI
> ...
> [ 3179.283997] Workqueue: events xp_release_deferred
> [ 3179.284770] RIP: 0010:idpf_find_rxq_vec+0x17/0x30 [idpf]
> ...
> [ 3179.291937] Call Trace:
> [ 3179.292392]  <TASK>
> [ 3179.292843]  idpf_qp_switch+0x25/0x820 [idpf]
> [ 3179.293325]  idpf_xsk_pool_setup+0x7c/0x520 [idpf]
> [ 3179.293803]  idpf_xdp+0x59/0x240 [idpf]
> [ 3179.294275]  xp_disable_drv_zc+0x62/0xb0
> [ 3179.294743]  xp_clear_dev+0x40/0xb0
> [ 3179.295198]  xp_release_deferred+0x1f/0xa0
> [ 3179.295648]  process_one_work+0x226/0x730
> [ 3179.296106]  worker_thread+0x19e/0x340
> [ 3179.296557]  ? __pfx_worker_thread+0x10/0x10
> [ 3179.297009]  kthread+0xf4/0x130
> [ 3179.297459]  ? __pfx_kthread+0x10/0x10
> [ 3179.297910]  ret_from_fork+0x32c/0x410
> [ 3179.298361]  ? __pfx_kthread+0x10/0x10
> [ 3179.298702]  ret_from_fork_asm+0x1a/0x30
> 
> Fix the error handling of the soft reset in idpf_xdp_setup_prog() by
> restoring the vport->xdp_prog to the old value. This avoids referencing
> the orphaned prog that was copied to vport->xdp_prog in the soft reset
> and prevents subsequent false positive by idpf_xdp_enabled().
> 
> Update the restart check in idpf_xsk_pool_setup() to use IDPF_VPORT_UP bit
> instead of netif_running(). The idpf_vport_stop/start() calls will not
> update the __LINK_STATE_START bit, making this test a false positive
> should the soft reset fail.
> 
> Fixes: 3d57b2c00f09 ("idpf: add XSk pool initialization")
> Signed-off-by: Emil Tantilov <emil.s.tantilov@intel.com>
> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
> ---
>  drivers/net/ethernet/intel/idpf/xdp.c | 7 ++++++-
>  drivers/net/ethernet/intel/idpf/xsk.c | 4 +++-
>  2 files changed, 9 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/net/ethernet/intel/idpf/xdp.c b/drivers/net/ethernet/intel/idpf/xdp.c
> index cbccd4546768..b670f0ea20b3 100644
> --- a/drivers/net/ethernet/intel/idpf/xdp.c
> +++ b/drivers/net/ethernet/intel/idpf/xdp.c
> @@ -488,12 +488,17 @@ static int idpf_xdp_setup_prog(struct idpf_vport *vport,
>  				   "Could not reopen the vport after XDP setup");
>  
>  		cfg->user_config.xdp_prog = old;
> -		old = prog;
> +		vport->xdp_prog = old;

You could just add 1 line here:

 		cfg->user_config.xdp_prog = old;
+		vport->xdp_prog = old;
 		old = prog;

And it would behave the same.

> +		if (prog)
> +			bpf_prog_put(prog);
> +
> +		goto out;
>  	}
>  
>  	if (old)
>  		bpf_prog_put(old);
>  
> +out:
>  	libeth_xdp_set_redirect(vport->netdev, vport->xdp_prog);
>  
>  	return ret;
> diff --git a/drivers/net/ethernet/intel/idpf/xsk.c b/drivers/net/ethernet/intel/idpf/xsk.c
> index d95d3efdfd36..b601b6c298c7 100644
> --- a/drivers/net/ethernet/intel/idpf/xsk.c
> +++ b/drivers/net/ethernet/intel/idpf/xsk.c
> @@ -553,6 +553,7 @@ int idpf_xskrq_poll(struct idpf_rx_queue *rxq, u32 budget)
>  
>  int idpf_xsk_pool_setup(struct idpf_vport *vport, struct netdev_bpf *bpf)
>  {
> +	const struct idpf_netdev_priv *np = netdev_priv(vport->netdev);
>  	struct xsk_buff_pool *pool = bpf->xsk.pool;
>  	u32 qid = bpf->xsk.queue_id;
>  	bool restart;
> @@ -568,7 +569,8 @@ int idpf_xsk_pool_setup(struct idpf_vport *vport, struct netdev_bpf *bpf)
>  		return -EINVAL;
>  	}
>  
> -	restart = idpf_xdp_enabled(vport) && netif_running(vport->netdev);
> +	restart = idpf_xdp_enabled(vport) &&
> +	       test_bit(IDPF_VPORT_UP, np->state);

The indentation is messed up, should be:

	restart = idpf_xdp_enabled(vport) &&
		  test_bit(IDPF_VPORT_UP, np->state);

(two tabs + 2 spaces)

>  	if (!restart)
>  		goto pool;

Thanks,
Olek